Free tool · 5 minutes · AU Voluntary AI Safety Standard
Score your AI governance maturity against the 10 guardrails of the Australian Voluntary AI Safety Standard. Voluntary today; leading indicator of pending mandatory regulation for higher-risk AI use cases.
8 questions · 4 domains
Score your AI governance maturity against the 10 guardrails of the AU Voluntary AI Safety Standard. The standard is voluntary today but is a leading indicator of pending mandatory regulation for higher-risk AI use cases.
Domain 1
Named accountable executive, AI governance committee, documented AI policy, risk management framework integration.
Is there a named accountable executive for AI governance?
Source: AU Voluntary AI Safety Standard Guardrail 1.
Is there a documented AI policy or acceptable-use standard?
Source: AU Voluntary AI Safety Standard Guardrails 1 and 8.
Domain 2
AI use case inventory, risk classification, impact assessment, ongoing monitoring of deployed AI.
Is there an inventory of AI use cases across the organisation?
Source: AU Voluntary AI Safety Standard Guardrail 2.
Are AI use cases risk-classified and reviewed before deployment?
Source: AU Voluntary AI Safety Standard Guardrails 2 and 4.
Domain 3
Data quality and provenance for AI systems, human-in-the-loop for high-impact decisions, contestability for AI-affected individuals.
How is data quality and provenance managed for AI systems?
Source: AU Voluntary AI Safety Standard Guardrail 3.
Is human-in-the-loop required for AI-influenced high-impact decisions?
Source: AU Voluntary AI Safety Standard Guardrail 5.
Domain 4
Disclosure to affected parties that AI is in use, contestability and challenge processes, records of AI decisions, third-party AI vendor assurance.
Are affected individuals notified when AI influences a decision about them?
Source: AU Voluntary AI Safety Standard Guardrails 6 and 7.
Are third-party AI vendors assessed for governance and safety practices?
Source: AU Voluntary AI Safety Standard Guardrail 9.
This is an indicative self-assessment aligned to the AU Voluntary AI Safety Standard. It is not legal or compliance advice. For verified results Frontrow runs an AI governance maturity review against actual use cases and policy documentation.
What the check covers
Domain 1
The Voluntary AI Safety Standard guardrails 1, 8 and 10 — establish accountability process, supply chain transparency, records and engagement with stakeholders. Without named ownership AI governance becomes nobody's job.
Domain 2
Guardrails 2 (risk management process) and 4 (testing and monitoring). Without an inventory of where AI is being used, governance can't be applied. Inventory and risk classification are the floor.
Domain 3
Guardrails 3 (data quality and governance), 5 (human oversight), 6 (transparency about AI use). Especially relevant for AI-influenced decisions affecting customers, employees, or candidates.
Domain 4
Guardrails 6 (transparency), 7 (contestability), 9 (third-party AI supply chain assurance). The transparency-and-contestability layer is what an OAIC or Privacy Commissioner investigation would test against.
Frequently asked questions
Published by the Department of Industry, Science and Resources in 2024. The standard establishes 10 guardrails for the safe and responsible use of AI in Australian organisations. It is voluntary today but is a leading indicator of pending mandatory regulation for high-risk AI use cases. The guardrails cover accountability, risk management, data quality, testing, human oversight, transparency, contestability, accountability process, supply chain transparency, and stakeholder engagement.
Not today. It is voluntary. However, several factors point toward mandatory AI regulation for high-risk use cases over the next 24 months. The EU AI Act has set a global benchmark. The OECD AI Principles inform the standard. The Privacy Act 2024 reforms include AI-influenced decision-making in scope. Mid-market organisations adopting the Voluntary Standard early are positioning ahead of the regulatory curve.
1) Establish accountability process; 2) Risk management process; 3) Data quality and governance; 4) Testing and monitoring; 5) Human oversight; 6) Transparency about AI use; 7) Contestability; 8) Records and engagement with stakeholders; 9) Third-party AI supply chain; 10) Accountability process for AI safety risks. The 10 are interconnected — most organisations find they need to address them in a connected programme, not standalone.
Microsoft 365 Copilot is an AI system under the Voluntary Standard's definition. The governance work matters even for Copilot specifically: the AI policy needs to cover Copilot use cases, the human-in-the-loop expectation applies to Copilot-influenced decisions, the data quality controls (sensitivity labels) determine what Copilot can access. Most AU mid-market AI governance work in 2026 is anchored on Copilot governance because it's the most-deployed AI system.
Custom agents (built in Copilot Studio or otherwise) are higher-risk than off-the-shelf Copilot because the organisation is the AI system owner, not the consumer. The governance bar is higher: documented purpose, data sources, decision impact assessment, testing before deployment, ongoing monitoring, and contestability process. Treat custom agents as a separate row in the AI use case inventory with high or medium risk classification by default.
AI-influenced decisions about individuals engage the Privacy Act 1988. APP 1 (open and transparent management), APP 5 (notification of collection), APP 11 (security), and APP 12 (access and correction) all read on AI decision-making about customers, employees and candidates. The OAIC has signalled that 'reasonable steps' under APP 11 will increasingly require AI-specific governance for high-risk AI use cases. The Voluntary AI Safety Standard provides a reasonable-steps baseline.
A direct review of AI use cases, AI policy, governance committee structure, risk classification, vendor assessment programme and contestability process. Output: gap report against the 10 guardrails of the AU Voluntary AI Safety Standard, prioritised remediation plan with named owners, draft AI policy and inventory templates. Indicative pricing on request.
Every scoring threshold cites a primary source: the AU Voluntary AI Safety Standard guardrails, the OECD AI Principles, ISO/IEC 42001 AI management systems standard, and the Microsoft Responsible AI Standard for the practical M365 mapping. Methodology authored by Daniel Brown (5x Microsoft MVP), Graeme Lodge (Managing Director), and Sam Williams (Investor & Executive Consultant).
